I was going through my box of old broken GB carts and found this Chinese Pokemon Red clone. I got it in a lot with several carts and never did anything with it since it was clearly a fake. Since I had the cart out, I dumped the ROM to see what was in there. If anyone is interested in the file, get it here: [Removed: Pokemon_Red_Fake.zip]

Code:

PCBKT-1871999.11.23

CHIPS28 PIN TSOPTOSHIBA TC55257DFTL-85VJAPAN 9626HAK

40 PIN TSOPFUJITSU MALAYSIA29LV004T-12PTN9723 F92

40 PIN TSOPMARKS SANDED OFFSMALL STAMP "Q D G F"

16 PIN DIPCD74HCT139ERCA H 615

14 PIN SOICTI ALS00A19KD

20 PIN DIPJAPAN 9535H74HC574AP

Last edited by skaman on Mon Sep 19, 2016 12:52 am, edited 2 times in total.

Let's assume for the moment that the sanded-off ROM is actually a 1 MiB 'PROM instead of a 256 KiB one, and the pirates pre-expanded the fixed bank. (In the absence of two 74'08s or 74'00s, this seems likely). So there's actually 1.5 MiB of storage.

There's a 74'574: that holds the bank. Plus a little; D6 and D7 are connected but clearly do something different. The 74'00 and 74'139 almost certainly decode some combination of address lines and the /WR strobe to make a single banking register...

Pokémon Red used the MBC3. The pirates clearly didn't include an RTC here.

Somehow they must have folded the 2 bits of RAM banking in with the 6 bits of ROM banking. But without any visible changes to the ROM as dumped, I have no idea how they did that. Maybe a re-dump that doesn't assume that $0000-$3FFF is fixed would cast light?

I looked at the two TSOPs more closely and they differ slightly. Maybe chips out of different batches/revisions? The dimensions are close but they don't appear to be exactly the same. The legs are slightly different between the chips. The circle that designates Pin 1 is also slightly larger and deeper on the Sanded TSOP.

I corrected the stamp on the Sanded TSOP to "Q D G F".

The cart appears to be able to be configured in either 2M, 4M or 8M based on markings on the PCB.

Unfortunately, my testing of the different chips appears to have corrupted the cart. I no longer get good data when I dump it.

Last edited by skaman on Mon Sep 19, 2016 1:39 am, edited 1 time in total.

74ALS00NAND#1: invert A15 (generate +ROMCE)NAND#2: NAND2(/A15,/Q5)NAND#3: invert Q5NAND#4: NAND2(/A15,Q5)→ Ok, the 74ALS00 is just the demultiplexer for the two ROM ICs. 29LV004 pin 37 is its /CE; the sanded ROM's pin 22 must be its.

74HCT139demux1: select when A14 is LOW (pin 1) and A15 is LOW (pin 3,5) and ??? is high (pin 2,5)demux2: select when A15 is LOW (pin 15) and A14 is HIGH (pin 14,11,9) and ... do something depending on whether A15 is HIGH or LOW ? that can't be right.

In hindsight, the bit where A14 and A15 connect to the '574 make me Very Suspicious.

I don't recognize its manufacturer logo, either, but that doesn't really mean much.

I would have asked you to see if it responds to flash commands, like:0x0555 <- 0xAA0x0AAA <- 0x550x0555 <- 0x90And then reading address 0000 and 0001 and see if you get a manufacturer and device id code, as a confirmation that this cart might be reusable as a flash cart. At least the chip with the markings intact looks like a flash chip based on the marking.

But after looking at the board, it seems that the /WR pin is pulled permanently high on the board, which means it can't see any writes. That's one of the pins in the fork like constellation next to the word 8M, and the corresponding traces on the next chip. It seems those traces are also extended below the chip to the other side to provide Vcc. If you really wanted to risk it, you could still lift the relevant pins and try it, but you would likely risk destroying at least those pins of the chip. Though I guess if you do, you still have a functioning pirate Pokémon cart.

You can see the pinout in various datasheets of similar standard flash ROMs like Am29LV008B. The relevant pins to lift are WR# and RY/BY#. which you should connect to either /WR on the cart bus, or VIN on the cart. Second from the right. This is often used on flash carts to avoid letting the game access the flash chip for example for detection purposes. (When new games were still being released.) The other pin you're recommended to lift and just leave unconnected is RY/BY# which would go low during flash chip erase/write operations, which would short Vcc to ground, depending on the strength of the transistor used for that function. Not ideal.

Note: The chip is what is listed as standard TSOP in the datasheet of Am29LV008B, not reverse TSOP and the chip is placed "upside down" when looking at the board as in the pictures.Note 2: /WR and WR# mean the same thing. They just different notations for an active low signal.

Who is online

Users browsing this forum: No registered users and 2 guests

You cannot post new topics in this forumYou cannot reply to topics in this forumYou cannot edit your posts in this forumYou cannot delete your posts in this forumYou cannot post attachments in this forum